From nobody Sun May 24 20:33:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C3A136BCDA for ; Thu, 21 May 2026 20:46:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779396410; cv=none; b=P+jFGuMRRm7cCD/sxFswEZy+orurL3UjcpRI5usT/xH6BAtkUIHa31l7evwQUkNoo4kXSUbx1og6PZKcPrbF6vnrRN1+VV7G/eDeLMEH7zjNPvU3fSy2SYyAJ9agH5oei/Rb9WjhFUeQ4wiRheA5hc76MRPtPiUllIerBpNFF7w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779396410; c=relaxed/simple; bh=Hroq4/kCtxq0aHuQaOsF+Ycfj4RY/KmgOVmy+9IIpPQ=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=cRW+EO7NFQ8NezzWiLkSbJir47V1piv7Tn1fvQo+rNtrGd+MiwiKN5XUSW6dsXMkpfi5QAnB3v9muVxSwKQ09qCEdamoILSKPHBP3FkAuJggcKkwBM2/Zw5VPRcSMF3jKDshKVRANlW86HSXQ/sEFDgEn9kSL4yTOKhmW8H1W2A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fXJzpO4s; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fXJzpO4s" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B19481F000E9; Thu, 21 May 2026 20:46:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779396408; bh=XCzF29he5XhGAdKJILoW3a0tRcnB+Pp2iNRpd+nn+u8=; h=Date:From:To:Cc:Subject:References; b=fXJzpO4sR3MVIp0fBhQoLS7MA7/zJNkV8or93HadmOQfwVDazknXa0XZuc83hywdz OKnINmLBGuVG+5XryNBoOKYavStFNpyup3XuLQ+PQ8VymRdrJg0p+PDjRuknp4B4Uf i5Qs+8A7D4bgHQzsjJnVbOfyQuG9qWwKreN2h+0IYXXRbJHUg6MFf3xoU4XHVSOIeJ dVPR40mV6WlxRt286PnTI5lxrP/fsBt/TzadmxNdk7VRN9GUcEJovuDfeOPs1XTDU3 AipZs0TqW25Mq2ICVQarXyI91n6C6VQfoGiQHFkWS0KqNqISXh7ewEwdHk+ZaNozo5 9HROa2aLi30yQ== Received: from rostedt by gandalf with local (Exim 4.99.2) (envelope-from ) id 1wQAIQ-00000005bnl-2wdT; Thu, 21 May 2026 16:47:10 -0400 Message-ID: <20260521204710.557408874@kernel.org> User-Agent: quilt/0.69 Date: Thu, 21 May 2026 16:45:28 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , David Carlier Subject: [for-linus][PATCH 1/2] tracing: Avoid NULL return from hist_field_name() on truncation References: <20260521204527.100913207@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: David Carlier hist_field_name() returns "" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses the bottom NULL->"" guard. Callers don't expect NULL: strcat(expr, hist_field_name(field, 0)) at trace_events_hist.c:1758 and the strcmp() in the sort-key match loop at :4804 both deref it. system and event_name are bounded by MAX_EVENT_NAME_LEN, but the field name on a VAR_REF is kstrdup'd from a histogram variable name parsed out of the trigger string and has no length cap, so a long enough var name in a fully qualified reference can reach the truncation path. Keep the length check but leave field_name as "" on overflow. Link: https://patch.msgid.link/20260508195747.25492-1-devnexen@gmail.com Fixes: 5ec1d1e97de1 ("tracing: Rebuild full_name on each hist_field_name() = call") Signed-off-by: David Carlier Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 0dbbf6cca9bc..eb2c2bc8bc3d 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1369,10 +1369,8 @@ static const char *hist_field_name(struct hist_field= *field, len =3D snprintf(full_name, sizeof(full_name), fmt, field->system, field->event_name, field->name); - if (len >=3D sizeof(full_name)) - return NULL; - - field_name =3D full_name; + if (len < sizeof(full_name)) + field_name =3D full_name; } else field_name =3D field->name; } else if (field->flags & HIST_FIELD_FL_TIMESTAMP) --=20 2.53.0 From nobody Sun May 24 20:33:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B8CB396565; Thu, 21 May 2026 20:46:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779396410; cv=none; b=lxYHPe6QHbMe7zPYeTnDwFHNYu/mDHfwukW94Y6/2GxU14x4zR6HoOfJYxKVf2e8sZCRox0EeW6zbcPKcTJJoMv9rLstnKWCjiyIMyA9atfjJg2BUdow9nNsv6FfY6aGS83ljq1PV7CkMMvDVY6hl3Js/Tzzqr2QCUmy1nx5BaY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779396410; c=relaxed/simple; bh=BWAc4z9O6RQUVrcaeEWmRg1cPqtAnCbya2f3Gm0Ns2Y=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=ZJ5jQACsQGvKgcBrvC0ZQwm0w3tknNGiFqBllj7DRe/Rlnbj/phWdqZIft/VIKkJVny0JD3hKVpkpT2gt1EbysA4MWUlk8LPBjClqSq0/3KmOy1bQfFhAzirJTY1pUwjieWO6v2NdznskCZheE1a+4zYce5SvTK5tdxLd5hsa9w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ohAJGhM2; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ohAJGhM2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E22A81F00A3D; Thu, 21 May 2026 20:46:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779396408; bh=3HerJI1+kkKx/hU7yzolHTbS2Y2cm4QjTTNEzsoC4I0=; h=Date:From:To:Cc:Subject:References; b=ohAJGhM2jiz/AiQoWVk+VpSEVvD0ecfhpLMraMi94wMFRYvfTPGQJZiNJr0Za/CF8 GkRVip9QTaEwMDdzSc+Al2nhR3Yswv2zZzUvf+b7t86d9neRUHnQ26fqbSYhScldT6 RQHJq1cQrq9FH7vETMQjEwnZk7VW3eg8rwdFI/XPZLv//YQepdg5eaw5stxU8xXwWa s/9XxUYqCM89FMwQY8clbJMlpYRbjYdpGdDQgZJ20dIU6XtkGp0CucWAKmmYtY/Liw tp+5ymF377SUM1qgUn6qcp1i7ETivbqiYp0peTmTxUCL1ODcAiZ3eTOgJF6m21MQTt 8zDuEm34s2+sA== Received: from rostedt by gandalf with local (Exim 4.99.2) (envelope-from ) id 1wQAIQ-00000005boF-3eR0; Thu, 21 May 2026 16:47:10 -0400 Message-ID: <20260521204710.725769391@kernel.org> User-Agent: quilt/0.69 Date: Thu, 21 May 2026 16:45:29 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Tom Zanussi , Rosen Penev , Sashiko Subject: [for-linus][PATCH 2/2] tracing: Do not call map->ops->elt_free() if elt_alloc() fails References: <20260521204527.100913207@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Masami Hiramatsu (Google)" In paths where tracing_map_elt_alloc() failed to allocate objects, the map->ops->elt_alloc() call was never successful. In this case, map->ops->elt_free() should not be called. Link: https://sashiko.dev/#/patchset/20260520223101.34710-1-rosenp%40gmail.= com Cc: stable@vger.kernel.org Cc: Tom Zanussi Cc: Mathieu Desnoyers Cc: Rosen Penev Reported-by: Sashiko Fixes: 2734b629525a ("tracing: Add per-element variable support to tracing_= map") Link: https://patch.msgid.link/177933895460.108746.5396070821443932634.stgi= t@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt --- kernel/trace/tracing_map.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index bf1a507695b6..0dd7927df22a 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -386,13 +386,11 @@ static void tracing_map_elt_init_fields(struct tracin= g_map_elt *elt) } } =20 -static void tracing_map_elt_free(struct tracing_map_elt *elt) +static void __tracing_map_elt_free(struct tracing_map_elt *elt) { if (!elt) return; =20 - if (elt->map->ops && elt->map->ops->elt_free) - elt->map->ops->elt_free(elt); kfree(elt->fields); kfree(elt->vars); kfree(elt->var_set); @@ -400,6 +398,17 @@ static void tracing_map_elt_free(struct tracing_map_el= t *elt) kfree(elt); } =20 +static void tracing_map_elt_free(struct tracing_map_elt *elt) +{ + if (!elt) + return; + + /* Only objects initialized with alloc_elt() should be passed to free_elt= ().*/ + if (elt->map->ops && elt->map->ops->elt_free) + elt->map->ops->elt_free(elt); + __tracing_map_elt_free(elt); +} + static struct tracing_map_elt *tracing_map_elt_alloc(struct tracing_map *m= ap) { struct tracing_map_elt *elt; @@ -444,7 +453,7 @@ static struct tracing_map_elt *tracing_map_elt_alloc(st= ruct tracing_map *map) } return elt; free: - tracing_map_elt_free(elt); + __tracing_map_elt_free(elt); =20 return ERR_PTR(err); } --=20 2.53.0